The account this token acts as and the workspaces it can see. Call this first in a new conversation: it confirms the token works and names the workspace everything else happens in. agentGrants is what THIS TOKEN may do; permissions is what its owner may do. A tool works only when both allow it, so read agentGrants to know which tools will succeed. mcp says which version of this server is running and whether it is out of date; if mcp.outdated is true, tell the person before reporting any bug, because it may already be fixed.

Creates a workspace with a first project, owned by this token's account. IMPORTANT: the response carries agentToken, a NEW token for the new workspace — this token cannot act in it. Show that value to the person and tell them to save it; it is returned once and cannot be retrieved again. Requires the workspace.create grant.

Every project in this token's workspace, with the prj_... ids the content tools take.

One project: what it is, which site it serves, and its settings.

A new site inside this workspace. Requires the project.write grant. The description and website fields are what make a list of projects readable later.

Change a project's name, description, website, or allowed origins. Only the fields passed change. allowedOrigins REPLACES the list: pass every origin, like ["https://example.com", "https://www.example.com"] — scheme and host, no path. It decides which websites may use the project key from a browser. Requires the project.write grant.

Content counts, key count, database mode and recent traffic for one project, in one call. Use this rather than listing everything to answer "what is in here".

The category tree, ordered so a parent always precedes its children; depth is how far to indent. Pass include="counts" to get how many posts sit in each.

A section of the blog, or a subsection of one when you pass parentId. Three levels deep at most. Requires the content.write grant.

Renames a category, or moves it under a different parent — which moves everything beneath it too. A category cannot be moved inside one of its own subcategories.

Posts filed under it are NOT deleted; they simply stop having a category. Its subcategories keep their path. Confirm with the person first.

Tags in a project, with how many posts use each.

Usually unnecessary: create_post and update_post create tags they do not find. Use this when a tag needs a description, or to set one up before writing.

The bylines available in this project, with the ids create_post takes.

A byline. This does NOT create an account or invite anybody — an author is content, and giving somebody access to the workspace is a separate thing a person does in the dashboard.

Posts in a project, newest published first. Paginate with cursor from the previous response — there is no page number, by design. Filter before paginating.

One post with its full body, by id or by slug.

Full-text search across titles and bodies, ranked. Use this to find something; use list_posts to enumerate. May require a paid capability on the workspace.

Writes a new post. It is a draft unless you say otherwise, which is usually what you want: publishing is a decision the person should make. Requires the content.write grant, and content.publish as well if you send status "published".

Changes only the fields you send; anything omitted is left alone. This is how a post is published: send status "published", which needs the content.publish grant on top of content.write. Pass expectedRevision (the revision from get_post) so that an edit made against an old copy is refused with REVISION_CONFLICT instead of overwriting a newer save; on that error, read the post again and reapply the change.

Soft-deletes a post: it stops being served and its slug becomes free again. Confirm with the person first. Requires the content.delete grant.

The read-only keys a website uses to read this project. Names, creation dates and the last four characters only — a whole key is shown once, when it is created, and never again. Requires the apikey.read grant.

Mints the credential a website reads this project with. IMPORTANT: the response carries the whole key exactly once. Show it to the person and tell them to put it in their environment — it cannot be retrieved afterwards. The key is read-only and returns published content only, so it is safe in a server environment; it is NOT safe in browser code unless the project has an allowed-origins list configured. Prefer this over handing a site the agent token, which can write and delete. Requires the apikey.write grant.

The official way to connect a project to CMSKite. For JavaScript and TypeScript that is the cmskite package; for PHP, WordPress, Laravel, Python or a plain HTML site it is the raw HTTP calls, which need no dependency at all. Returns what to install if anything, the files to write, and which key belongs on the server versus in the browser. Call this BEFORE writing any integration code by hand: hand-rolled fetch wrappers miss view tracking entirely, so the customer gets a working site with no analytics and no indication that anything is missing. Finish by calling check_integration, which is the only thing that can tell a working integration from one that silently reports nothing. Does not read or change anything in CMSKite.

Checks whether a project is really connected to a website: does it have a key, has a site ever used it, and are views arriving from the pages that render the content. Each check comes back with the one action that fixes it. ALWAYS call this after wiring up an integration, and always when somebody says views or analytics are zero — a site can fetch content perfectly and report nothing, and this is the only thing that tells the difference. Requires the project.read grant.

What readers did with a project’s posts over a date range: totals, a daily series, and the posts that were actually read. Read from rollups, so the answer is the same size whatever the traffic was. If everything is zero, call check_integration — that is a tracking problem far more often than it is a traffic problem. Requires the analytics.read grant.

Views, unique readers and clicks for one post, per day. The way to check that a specific post's view landed after wiring up tracking: open the post in a real browser (headless browsers are not counted), wait about a minute for the rollup, then call this. A reader counts once per post per day. Requires the analytics.read grant.